|
Title: Please help me! Post by: mikers4 on March 14, 2018, 04:24:46 AM Hi to all.
I am struggling to find any Bosch function and data sheets for Porsche 996GT3 or 997GT3. I wanted to know how to turn on an output to drive/control a solenoid valve. At the moment it has a very fast earth pulse trigger down the output wire from the ECU and no matter what I change I can't get it to change at all. I have emulated it with OLS300 and the 2nd flap map is active and been accessed. I have modified ESKONF and this has had no effect. I have even copied over the ESKONF from a 997 GT3 and it is still the same.... I ultimately need to drive a 2nd actuator to control a flap on the intake manifold. Any help appreciated. I just don't understand enough to go any further. Title: Re: Please help me! Post by: vdubnation on March 14, 2018, 07:27:11 PM ESKONF is diagnosis not the function whats your sw version i ll take a look.
Title: Re: Please help me! Post by: mikers4 on March 15, 2018, 12:01:10 AM Hi, thanks for the reply.
Software version is 350598 according to Winols HW number 0261206579 I did get to the conclusion that the ESKONF was just for diagnostics but then convinced myself otherwise! Very new to this scene. Mike Title: Re: Please help me! Post by: mikers4 on March 15, 2018, 01:09:45 AM Hi, thanks for the reply. Software version is 350598 according to Winols HW number 0261206579 I did get to the conclusion that the ESKONF was just for diagnostics but then convinced myself otherwise! Very new to this scene. Mike Title: Re: Please help me! Post by: nubcake on March 15, 2018, 05:38:46 AM Got 997GT3 bin?
Or any other 996 running twin flaps? Title: Re: Please help me! Post by: mikers4 on March 15, 2018, 07:35:33 AM Got 997GT3 bin? Or any other 996 running twin flaps? 997 GT3 file attached. no 996 cars ran two flaps. Title: Re: Please help me! Post by: nubcake on March 15, 2018, 01:04:34 PM Sorry, quite busy currently.
Took a brief look - and it appears B_su2 is not even getting copied to pin output in your binary. If that's the case - some custom assembly code is needed to implement that. I'll try to give a more detailed reply later. Title: Re: Please help me! Post by: mikers4 on March 15, 2018, 01:50:33 PM Thank you.
Title: Re: Please help me! Post by: nubcake on March 15, 2018, 06:02:44 PM So.
0xFD56, mask 0x100 is B_su2. It indeed doesn't go anywhere after being set by KFSU2 output. Basically making it "go out of ECU" consists of 2 main tasks: 1) Find out how it's physically interfaced with CPU. Essentially, which logical address corresponds to this particular pin. 2) Actually write the control code. 2 is fairly easy, I won't go into details here. You can for example look at how B_su is being actuated in the code (basically, it's bit copy of "logical value B_su" to "physical output"). For 1 I see 3 possible options: 1) Find an absolutely identical (hardware-wise) ECU (or, essentially, bin from it), where this particular pin is actually utilized for something. Look at corresponding code, note the address. 2) Or open ECU up, back-trace pin to the driver and try to find out how it's interfaced with CPU. Maybe look at other devices hooked up to the same driver, take some hints from that. 3) Or just re-purpose any other known (but for some reason spare) output. Probably the easiest way. If that sounds too complicated to DIY, I can do it for you. Won't be free, however. Title: Re: Please help me! Post by: mikers4 on March 16, 2018, 01:27:44 PM So. 0xFD56, mask 0x100 is B_su2. It indeed doesn't go anywhere after being set by KFSU2 output. Basically making it "go out of ECU" consists of 2 main tasks: 1) Find out how it's physically interfaced with CPU. Essentially, which logical address corresponds to this particular pin. 2) Actually write the control code. 2 is fairly easy, I won't go into details here. You can for example look at how B_su is being actuated in the code (basically, it's bit copy of "logical value B_su" to "physical output"). For 1 I see 3 possible options: 1) Find an absolutely identical (hardware-wise) ECU (or, essentially, bin from it), where this particular pin is actually utilized for something. Look at corresponding code, note the address. 2) Or open ECU up, back-trace pin to the driver and try to find out how it's interfaced with CPU. Maybe look at other devices hooked up to the same driver, take some hints from that. 3) Or just re-purpose any other known (but for some reason spare) output. Probably the easiest way. If that sounds too complicated to DIY, I can do it for you. Won't be free, however. How have you found B_su ? Have you used IDA pro..? Mime Title: Re: Please help me! Post by: nubcake on March 16, 2018, 02:59:25 PM Yes.
B_su is the same 0xFD56 address, but 0x80 mask. Title: Re: Please help me! Post by: mikers4 on March 16, 2018, 03:30:52 PM How do you know that B-su2 is that address..? What are you referencing it against...?
I have only downloaded IDA today so am just getting started... Mike Title: Re: Please help me! Post by: nubcake on March 16, 2018, 04:41:03 PM How do you know that B-su2 is that address..? What are you referencing it against...? I have only downloaded IDA today so am just getting started... Mike A bunch of other ME7 binaries. There are some A2L files floating around that can help you build proper references. Then it's a game of pattern finding and matching. You can try looking through my older posts, I briefly described the process several years ago. Learning curve is very steep, I have to say. :) |